2010 International Conference on Business and Economics Research vol.

1 (2011) (2011) IACSIT Press, Kuala Lumpur, Malaysia

Enterprise Risk Management Framework and The Empirical Determinants of Its Implementation
Fong-Woon Lai
Management and Humanities Department Universiti Teknologi PETRONAS Perak, Malaysia e-mail: laifongwoon@petronas.com.my
AbstractThis paper features a fourteen-element enterprise risk management framework covering the governance, structure, and process dimensions and provides empirical determinants for its implementation among public listed companies in Malaysia. The framework highlights an effective management of firms idiosyncratic risks. The paper aims to present an empirical evidence to support value maximization theory of corporate risk management and simultaneously refute the neo-classical finance theory (NCFT) which postulates that firm-specific risk is irrelevant. Data was collected through questionnaire survey from 128 companies listed on the Malaysian bourse. The empirical results which were derived through product moment correlation tests find that ERM implementation has significant positive associations with reducing cost of financial distress, lowering cost for external financing, improving firms credit rating, receiving reward from equity market, reducing informational asymmetries, and reducing agency problem. Keywords-enterprise risk management; effective implementation framework; value maximization hypotheses; capital asset pricing model; neo-classical finance theory

Fazilah A. Samad
Faculty of Business and Accountancy University of Malaya Kuala Lumpur, Malaysia e-mail: mfazilah@um.edu.my quantify their transactional risk exposure in the companies annual reports, including that of off-balance sheet activities. These are efforts by the Malaysian regulators to safeguard the interest of investing public through regulating accounting standards approach. However, looking from a more macro level of Malaysian regulatory framework, there is no specific piece of law (such as that of Sarbanes-Oxley Act in the United States) that imposes the need for a rigorous corporate or enterprise risk management program to be implemented by the public listed companies (PLCs). Perhaps the closest reference in the Malaysian regulatory framework which requires Malaysian PLCs to manage risk lies within the Malaysian Code on Corporate Governance. II. LITERATURE REVIEW Neo-classical finance theory (NCFT) postulates that firmspecific risk is irrelevant and that only the covariance of the firms asset returns to the market portfolio, which is measured by the beta in the capital asset pricing model (CAPM), is important. This suggests that implementation of ERM has no value to firms and shareholders. However, this notion is in stark contrast to the phenomena of increased acceptance of ERM by industry practitioners. Nevertheless, ERMs efficacy in creating value for firms and shareholders has rarely been empirically tested. NCFT holds that in the perfect and complete market condition, investors have full information pertaining to the risks in the firm. As such, investors are able to hedge the firm-specific risk as easily as the firm could itself through diversification of their portfolio holding. As a result, risk management activities by the firm will not make any difference in terms of value creation in relation to what investors are able to do for themselves. This notion is obviously at odds with the concept of corporate risk management. This is especially so with the value propositions expounded by the concept of ERM [1]. To rebut the arguments put forth by the NCFT, newer theory of corporate risk management began to look into frictional costs that associated with corporate risk. For instance, study as in [2] pointed out that risk would tend to increase taxes and the prospective costs of financial distress. Moreover, when a firms cash flows were risky, conflicts of interest arose between shareholders and creditors. Following are determinants for corporations engaging in risk management activities which are in tandem with the respective value maximization hypotheses of risk

I.

INTRODUCTION

This paper features an effective implementation framework of enterprise risk management (ERM) and provides empirical determinants of its implementation among public listed companies (PLCs) in Malaysia. ERM is defined as the process of identifying and analyzing risk from an integrated, company-wide perspective. It is a structured and disciplined approach in aligning strategy, processes, people, technology and knowledge with a purpose of evaluating and managing the uncertainties facing the enterprise as it creates value for firms and shareholders. ERM ensures that all significant risks are understood and therefore, prioritized. Information on risk obtained as a result of active engagement of risk management can be organized for an effective decision making in investment, capital budgeting, performance, and reward evaluations. The ERM implementation framework essentially provides a conduit for managing firms idiosyncratic risks apart from those of systematic risks. Furthermore, ERM focuses on relating risks and aligning risk management initiatives to business objectives and overall corporate strategy in order to attain competitive advantages [1]. The Malaysian regulators, i.e. Securities Commission and Bursa Malaysia, have compelled public listed companies to

340

management theory. These determinants serve as the foundation for value creating propositions of ERM implementation by corporations [1]. A. Financial Distress Cost Hypothesis One primary rationale for risk management is to mitigate the costs of financial distress. There are evidences to support the hypothesis that firms engage in risk management if they are more likely to incur financial distress costs. However, study as in [3] pointed out that the evidence was not persuasive for non-financial companies. In a similar note, a study by [4] provided an evidence that firms with lower credit ratings were more likely than those with higher rating to use derivative contracts such as swaps for risk management. B. Lower Tax Burdens Hypothesis Empirical study by [5] reported non-financial companies with higher investment tax credits were more prompt to transact in derivative markets a form of risk management. Reference [6] also lent evidence to support the tax hypothesis that taxes were a significant determinant for companies to engage in derivative transactions. C. Costly External Financing Hypothesis Studies have shown that firms engage in risk management using derivatives to ensure the stability of internal funding mechanism through the reduction of income stream variation. This is to ensure that firms have sufficient internal fund to undertake attractive and positive yielding projects. Internal funding is preferred over the external ones because the former is cheaper. For instance, study as in [7] documented evidence that non-financial firms with low levels of liquidity and high growth opportunities, as measured by the ratio of the market value to the replacement value of the firm, tend to hedge more with derivatives. Reference [5] found that less liquid non-financial firms were more likely to use derivative to prevent situations in which firm might force to forgo valuable projects due to a shock to the internal capital resources. D. Agency Problem Hypothesis Reference [3] argued that managers had an economic incentive to ensure the firm continued to do well in that they had disproportionately large investments in the forms of their skills or human capital in the firm. It would be costly to transfer these skills should they need to seek other work. As such, managers were concerned about any negative shocks to profits which might result in putting the firm into financial distress or the edge of bankruptcy. Bankruptcy and times of financial distress often led to the replacement of current management. This posed a huge personal risk that could not be easily diversified away like what shareholders could. E. Informational Asymmetry Hypothesis Reference [8] argued that if asymmetric information existed between managers and potential outside investors, it would result in even a fundamentally sound firm, when facing temporary distress, found raising the needed funds in

the capital market to be either not easily available or too costly. For instance, firm would have to sell securities to outsiders at a discount, which was less than the fullinformation value of the claims on the firm. III. THE PROPOSED ERM IMPLEMENTATION FRAMEWORK Our proposed ERM framework consists of fourteen implementation elements deemed to be relevant and important to define the intensity, maturity, and penetration level of ERM practices. The fourteen elements cover seven aspects of the very essence of ERM implementation namely, (i) ERM definition, (ii) effective communication of risk and responsibilities, (iii) philosophy of ERM, (iv) risk identification and response, (v) compliance, (vi) risk quantification, and (vii) performance measurement. These seven aspects, in turns, embody the three principal dimensions of the ERM framework, i.e. the process, governance, and structure. TABLE I presents the three principal dimensions, their corresponding aspects as well as the respective implementation elements in the proposed framework.
TABLE I. Dimension Structure Performance measurement Information and roles Governance Compliance Process Integration of business strategy and objectives Risk identification and response Risk quantification DIMENSIONS AND AREAS OF ERM IMPLEMENTATION FRAMEWORK Aspect ERM Definition Elements 1 2 13 14 3 4 10 11 5 6 7 8 9 12

TABLE II presents the fourteen implementation elements in the proposed framework and the justifications of their inclusion in the implementation framework are as follows:
TABLE II. Element 1 2 3 4 5 6 7 8 9 10 11 12 THE FOURTEEN ELEMENTS ERM IMPLEMENTATION FRAMEWORK Statement provides common understanding of the objectives of each ERM initiative provides common terminology and set of standards of risk management provides enterprise-wide information about risk Enables everyone to understand his/her accountability Integrates risk with corporate strategic planning Integrated across all functions and business units ERM strategy is aligned with corporate strategy Aligns ERM initiatives to business objectives Provides the rigor to identify and select risk responses (i.e. risk- avoidance, reduction, sharing and acceptance) Reduces risk of non-compliance Enables tracking costs of compliance Quantifies risk to the greatest extent possible

341

13 14

Identifies key risk indicators (KRIs) Integrates risk with key performance indicators (KPIs)

A. ERM Definition One of the forefront challenges to ERM implementation is to define what ERM really means to corporations. In the absence of standard definition for the meanings of the various terms used in ERM initiatives and without the provision of a precious goal for its implementation, it is difficult to envisage a successful implementation of ERM program. Hence, the inclusion of elements (1) and (2) (in TABLE II) in our framework is to capture this essence. B. Effective Communication of Risk and Responsibilities Besides, ERM initiatives can only be successfully implemented if everyone in the organization is clear about the type and nature of risk relevant to the enterprise. Thus, all pertinent information about the existing and potential risk faced by the enterprise must be effectively disseminated. Channel of communication must be open to facilitate topdown and bottom-up communication taking place to ensure all members of the firm understand their roles and responsibility in regard to the risk [9]. The inclusion of elements (3) and (4) is to serve this end. C. Philosophy of ERM Statements (5), (6), (7), and (8) are included to capture the philosophy of ERM program. The essence and the very notion of ERM implementation are to integrate risk with business objectives and to align risk management initiatives with the overall corporate strategy in order to attain competitive advantages. This alignment and integration of risk must pervasively envelop all business units in the firm [9]. D. Risk Identification and Response Statement (9) relates to ERM providing rigor to enterprise to enhance its capability in identifying and selecting among alternative risk responses. The responses include risk avoidance, reduction, sharing and acceptance. The ability and efficiency of a firm to identify risk and subsequently respond to it are elements which are integral to an effective corporate risk management program [10]. E. Compliance Cost In the enterprises day-to-day operating environment, among the many business objectives, one of them more often than not, involves a compliance objective to the applicable laws and regulations. This objective is especially apparent in highly regulated industries such as the finance, banking, gaming, and public utilities sectors. Besides, compliance can also relate to meeting firms internal corporate governance requirements. Owing to this, the cost incurred in such compliance initiatives can make up a significant chunk of the overall business operating cost. Hence, the inclusion of statements (10) and (11) in the questionnaire gauges how far ERM enables the management to track such compliance cost and the risk of non-compliance.

F. Risk Quatification Statement (12) relates to risk quantification. Before any specific response in regard to risk can be undertaken, enterprise needs to quantify them. Most of the quantification processes will involve the conversion of calculated risk into currency denomination. This is to provide a precise perspective to facilitate decision rule in the light of potential loss or damages in monetary terms before any response decision is made. G. Performance Measurement Statements (13) and (14) relate to performance measurement. The underpinning philosophy of implementing ERM program is to transform the entire organization to an enterprise that is internalized with risk-aware culture. To this end, it is imperative to identify key risk indicators (KRI) relevant to the firms business and to tie those KRIs to staff members key performance indicators (KPI). These KRIs and KPIs will enhance the firms focus on balanced riskreward trade-offs by effectively rewarding people for taking smarter risks. IV. METHODOLOGY Data was collected through questionnaire survey from senior officials of companies listed on the Malaysian stock exchange, known as Bursa Malaysia. There are 128 answered questionnaires collected from the survey exercise. Majority of the respondents are large public listed companies (PLCs) by market capitalization. A. Hypotheses Development This study develops and tests hypotheses H1, H2, H3, H4, H5, H6, and H7 as shown in TABLE III in an attempt to empirically examine the pertinent value maximization theories with data collected from the public listed companies on the Bursa Malaysia. The testing of each hypothesis involves bivariate product moment correlation test (Pearson correlation coefficient) in examining the association significance between the independent variable, i.e. ERM Implementation Intensity with the various dependent variables, which correspond to the various determinants expounded by the value maximization theory of corporate risk management as shown in column (c) of TABLE III. B. The Independent Variables: ERM Implementation Intensity The independent variable construct ERM Implementation Intensity is measured by a measurement metric made up of fourteen survey statements presented to respondents for their assessment. These survey statements are as in TABLE II and they are measured in the form of 5-point Likerts scale in the questionnaire. The statements gauge respondents agreement ratings in regard to the various elements found in, or impacts resulted from, the respondents ERM implementation process. The fourteen statements in the questionnaire serve as a proxy for ERM implementation intensity by the PLCs.
TABLE III. THE THEORY, HYPOTHESES AND QUESTIOANNAIRE STATEMENTS

342

Value Maximization Theory (a) Cost of financial distress Lowering tax burden Cost for external financing Firms credit rating Equity market reward Informational asymmetries Agency problem

Hi (b) H1: H2: H3: H4: H5: H6: H7:

Questionnaire Statement / Dependent Variable (c) ERM reduces expected costs of financial distress ERM reduces companys expected taxes ERM reduces the cost for external financing ERM has a positive impact on enterprises credit rating ERM program will be rewarded by the equity market ERM reduces information gap between managers and investors ERM reduces volatility of managers bonuses and salaries

Result of the mean score indicates that the overall average mean score gauging the PLCs ERM implementation intensity is 3.82. This value falls within the semantic scale of good as defined in TABLE IV. As a result, we can infer that the overall ERM penetration level among the PLCs is rather encouraging. C. Test of Value Maximization Determinants of ERM Implementation In the bivariate correlation analysis, hypotheses H1, H2, H3, H4, H5, H6, and H7 were tested using product moment correlation (PMC) statistic. The PMC statistic, also known as Pearson correlation coefficient, summarizes the strength of association between two metric variables. The coefficient (r) values above 0.5 are considered to be indicating strong association between an independent and dependent variables [15]. Further more, the linear relationship between a particular two independent and dependent variables is statistically tested for its significance using t statistic. The test for significance is performed by examining the following hypotheses: H0: 1= 0 HA: 1 0 with the null hypothesis, H0, implies that there is no linear relationship between the independent and dependent variables. The alternative hypothesis, HA, implies that there is a linear relationship between independent and dependent variables (1 0) and the association is statistically significant [11]. D. Examination of ERM Value Maximization Hypotheses Seven hypotheses (as in TABLE III) are being tested for the value maximization theory of ERM implementation. Out of the seven hypotheses tested, all excepts one show positive and significant associations between the independent and dependent variables. TABLE V presents these findings. From the six significant associations, the strengths of two associations are considered to be strong with the Pearson coefficient (r) values above 0.5 (H1 and H3). The strength of associations of the other four can be described as, at best, marginal. The r values of these four associations range from 0.304 to 0.401(H2, H4, H5, H6, and H7).
TABLE V. Hi H1: H2: H3: H4: H5: H6: RESULTS OF HYPOTHESES TESTINGS ON H1 TO H7 Dependent Variable reduces cost of financial distress lowers tax burden reduces cost for external financing improves firms credit rating will be rewarded by equity market reduces (r) Value .548 .044 .692 .304 .338 .315 p-value 2-tailed .000*** .815 .000*** .000*** .000*** .000*** Independent Variable ERM implementation ERM implementation ERM implementation ERM implementation ERM implementation ERM

C. The Dependent Variables The dependent variable for each bivariate correlation test is a single variable presented to respondents as a statement in the questionnaire for their rating in 5-point Likerts scale. Each statement describes the pertinent dependent variable in the bivariate product moment correlation tests. TABLE IIIs column (b) and (c) present the relevant hypotheses being tested and their corresponding value maximization theory of ERM implementation are shown in column (a). V. FINDINGS

A. Scale Reliability Test of ERM Implementation Framework The test for scale reliability is conducted on the ERM Implementation Intensity construct. The ERM Implementation Intensitys summated scale is constructed using 14 statements in the questionnaire as described earlier. The reliability analysis presents the Cronbachs alpha score of 0.855, indicating satisfactory internal consistency reliability of the summated scale [11]. B. Penetration of ERM Implementation Among PLCs To examine the depth of ERM practices penetration among the public listed companies, this study analyzed the frequency distribution of mean scores for the summated scales of the various aspects of the ERM implementation intensity metric (i.e. the fourteen elements as in TABLE II) provided by the PLCs through questionnaires. To provide a clearer perspective and better interpretation of the PLCs ERM implementation intensity, we develop a descriptive semantic scale as shown in TABLE IV as a reference to the corresponding ranges of mean scores of the summated scales which are computed from the 5-point Likerts scale.
TABLE IV. SEMANTIC SCALE OF ERM IMPLEMENTATION INTENSITY Semantic scale (ERM Implementation Intensity) Excellent Good Satisfactory Poor

Mean score (on 5-point Likerts scale) 4.0 5.0 3.5 4.0 3.0 3.5 < 3.0

343

implementation H7: ERM implementation

informational asymmetries reduces agency problem

[1] .401 .000*** [2]

***significant at =0.01 level

VI.

CONCLUSIONS

[3]

Results of the analysis indicate that the intensity of ERM program implementation among the respondents is in good, category of the semantic scale with the average mean score of 3.82 on the 5-point Likerts scale. Hence, it can be concluded that the penetration of ERM practices among Malaysian listed companies are relatively encouraging. This is so considering that Malaysia does not have specific laws governing corporate risk management like that of SarbanesOxley Act in the United States. Obviously, it would seem to be in the best interest of shareholders if the results would have been in the category of excellent. Nonetheless, by placing the findings in a bigger scheme of comparison, e.g. vis--vis the regulatory requirement for ERM in Malaysia, it seems that ERM practices among the Malaysian PLCs are heading in the right and desirable directions and the finding also suggests that the PLCs appreciate the significance of ERM implementation. The tests on ERM value maximization theory through hypotheses H1, H3, H4, H5, H6, and H7 have ascertained the notion that value can be created in various forms of business performance through ERM implementation, at least in the perceived manner. This business performance can be materialized in the forms of reduced cost of financial distress as well as cost of external financing, improved firms credit rating, rewards by equity market through higher premium paid by investors for companys shares, as well as reduced informational asymmetries and agency problem in the firms. Perhaps if the transmission mechanism of these perceived value creating properties of ERM implementation as revealed by the hypotheses testing could be objectively quantified through a specific model, e.g. via a strategic conceptualization of the firms risk premium model for managing idiosyncratic risks (see [1]), it would evoke a far reaching implication in facilitating the development of a risk pricing model which compensates for such idiosyncratic risk reduction. Such a risk pricing model could result in lowering the firms cost of capital. The empirical findings simultaneously refute the supposition by the neo-classical finance theory which postulates that managing firm-specific risk is futile. The findings point out that managing firm-specific (unsystematic) risk through ERM program is able to contribute positively to various forms of business performance as mentioned above, hence creating value for the enterprises. This conclusion implies that firms should not hesitate to commit and invest their time and resources, e.g. man power, IT infrastructure, training, and etc., in instituting a formal and effective ERM framework within their management structure. This is because such initiatives are justifiable in managerial sense owing to their value creating capability. REFERENCES

[4]

[5]

[6]

[7]

[8]

[9] [10]

[11]

F.W. Lai, A. Azizan and F. Samad, A Theoretical Appraisal of Value Maximizing Enterprise Risk Management, International Journal of Accounting Information Science and Leadership, vol.3, no.6, 2010, pp.23-41. N.A. Doherty, Integrated Risk Management, McGraw-Hill, New York, 2000. Cummins, Phillips and Smith, The Rise of Risk Management, Economic Review Federal Reserve Bank of Atlanta, vol. 83, no.1, 1998, pp.30-38. L.D.Wall and J. Pringle, Alternative Explanations of Interest Rate Swaps: An Empirical Analysis, Financial Management, vol.18, 1989, pp. 119-49. D.R. Nance, C.W. Smith, and C.W. Smithson, On the Determinants of Corporate Hedging, Journal of Finance, vol.68, 1993, pp.267-284. J.D. Cummins, R.D. Phillips and S.D. Smith, Derivatives and Corporate Risk Management: Participation and Volume Decisions in the Insurance Industry, in Conference of the International Association of Finance Engineers, Boston, 1997. G.D. Gay and J. Nam, The Underinvestment Problem and Derivative Usage by Corporations, Financial Management, vol.27. 1998, pp. 53-69. K.A. Froot, D.S. Scharfstein, and J.C. Stein, Risk Management, Coordinating Corporate Investment, and Financing Policies, Journal of Finance, vol. 48, 1993, pp. 1,629-1,658. C. Chapman, Bringing ERM into focus, The Internal Auditor, vol.60, no.3, 2003, pp.30. G..J. Bierc, Risk management infrastructure can boost corporate performance, Financial Executive, vol.19, no.3, 2003, pp.59-61. N.K. Malhotra, Marketing Research: An Applied Orientation, 4th edition, Pearson-Prentice Hall, 2004.

344